@goodandready/dsh-cost-meter 0.8.15 → 0.8.17

package/lib/client.js

@@ -433,10 +433,25 @@ window.__ModuleLoader__.load({
       const minutes = Math.max(0, Math.round((Date.now() - timestamp) / 60000))
       if (minutes < 1) return isZh ? '刚刚' : 'just now'
       if (minutes < 60) return minutes + (isZh ? ' 分钟前' : ' min ago')
-      const hours = Math.round(minutes / 60)
       return hours < 48 ? hours + (isZh ? ' 小时前' : ' hrs ago') : Math.round(hours / 24) + (isZh ? ' 天前' : ' days ago')
     }
 
+    function fetchWithTimeout(url, options = {}, timeoutMs = 15000) {
+      const { signal, ...rest } = options
+      const timer = typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function'
+        ? AbortSignal.timeout(timeoutMs)
+        : null
+      let combined = signal
+      if (timer) {
+        if (signal && typeof AbortSignal.any === 'function') {
+          combined = AbortSignal.any([signal, timer])
+        } else if (!signal) {
+          combined = timer
+        }
+      }
+      return fetch(url, { ...rest, ...(combined ? { signal: combined } : {}) })
+    }
+
     // ---------------------------------------------------------------- card
 
     function CostMeterCard(props) {
@@ -467,10 +482,10 @@ window.__ModuleLoader__.load({
         notice: '',
       })
 
-      const checkUpdate = React.useCallback(async () => {
+      const checkUpdate = React.useCallback(async (signal) => {
         setUpdateState((s) => ({ ...s, checking: true, error: '' }))
         try {
-          const res = await fetch(UPDATE_PATH)
+          const res = await fetchWithTimeout(UPDATE_PATH, { signal })
           if (!res.ok) throw new Error('HTTP ' + res.status)
           const data = await res.json().catch(() => ({}))
           setUpdateState((s) => ({
@@ -482,22 +497,27 @@ window.__ModuleLoader__.load({
             canAutoUpdate: data.canAutoUpdate !== false,
           }))
         } catch (e) {
-          setUpdateState((s) => ({ ...s, checking: false }))
+          if (e?.name !== 'AbortError') {
+            setUpdateState((s) => ({ ...s, checking: false }))
+          }
         }
       }, [])
 
       React.useEffect(() => {
-        if (open) checkUpdate()
+        if (!open) return
+        const controller = new AbortController()
+        checkUpdate(controller.signal)
+        return () => controller.abort()
       }, [open, checkUpdate])
 
       async function handleTriggerUpdate() {
         if (updateState.updating) return
         setUpdateState((s) => ({ ...s, updating: true, error: '', notice: '' }))
         try {
-          const res = await fetch(UPDATE_PATH, {
+          const res = await fetchWithTimeout(UPDATE_PATH, {
             method: 'POST',
             headers: { 'x-dsh-plugin-update': '1' },
-          })
+          }, 30000)
           const data = await res.json().catch(() => ({}))
           if (!res.ok || data.ok === false || data.error) {
             throw new Error(data.error || ('HTTP ' + res.status))
@@ -534,8 +554,8 @@ window.__ModuleLoader__.load({
 
       React.useEffect(() => { ensureStyles() }, [])
 
-      const fetchDiag = React.useCallback(() => {
-        fetch(STATE_PATH, { headers: { accept: 'application/json' } })
+      const fetchDiag = React.useCallback((signal) => {
+        fetchWithTimeout(STATE_PATH, { signal, headers: { accept: 'application/json' } })
           .then((r) => (r.ok ? r.json() : null))
           .then((data) => { if (data) setDiagState(data) })
           .catch(() => {})
@@ -543,7 +563,9 @@ window.__ModuleLoader__.load({
 
       React.useEffect(() => {
         if (!open) return
-        fetchDiag()
+        const controller = new AbortController()
+        fetchDiag(controller.signal)
+        return () => controller.abort()
       }, [open, fetchDiag])
 
       const status = (snapshot && snapshot.status) || 'loading'
@@ -572,7 +594,7 @@ window.__ModuleLoader__.load({
         setSyncing(true)
         setSyncMsg('')
         try {
-          const res = await fetch(REFRESH_PATH, { method: 'POST', headers: { accept: 'application/json' } })
+          const res = await fetchWithTimeout(REFRESH_PATH, { method: 'POST', headers: { accept: 'application/json' } })
           if (res.status === 429) {
             const data = await res.json().catch(() => ({}))
             const retryAfter = data.retryAfter || 30
@@ -1034,10 +1056,10 @@ window.__ModuleLoader__.load({
 
       const reqSeq = React.useRef(0)
 
-      const load = React.useCallback((keys) => {
+      const load = React.useCallback((keys, signal) => {
         const seq = ++reqSeq.current
         const query = keys ? '?models=' + encodeURIComponent(keys) : ''
-        fetch(STATE_PATH + query, { headers: { accept: 'application/json' } })
+        fetchWithTimeout(STATE_PATH + query, { signal, headers: { accept: 'application/json' } })
           .then((r) => (r.ok ? r.json() : null))
           .then((data) => {
             if (data && seq === reqSeq.current) setState(data)
@@ -1045,8 +1067,17 @@ window.__ModuleLoader__.load({
           .catch(() => {})
       }, [])
 
-      React.useEffect(() => { load(usedKeys) }, [load, usedKeys])
-      React.useEffect(() => { if (open) load(usedKeys) }, [open, load, usedKeys])
+      React.useEffect(() => {
+        const controller = new AbortController()
+        load(usedKeys, controller.signal)
+        return () => controller.abort()
+      }, [load, usedKeys])
+      React.useEffect(() => {
+        if (!open) return
+        const controller = new AbortController()
+        load(usedKeys, controller.signal)
+        return () => controller.abort()
+      }, [open, load, usedKeys])
       React.useEffect(() => {
         const id = setInterval(() => setNow(new Date()), 15000)
         return () => clearInterval(id)
@@ -1449,6 +1480,7 @@ window.__ModuleLoader__.load({
       minutesUntilChange,
       extremes,
       ratesAt,
+      fetchWithTimeout,
     }
     return module.exports
   },

package/lib/index.js

@@ -1,4 +1,4 @@
-import { registerPluginUpdater } from './updater.js'
+import { registerRoutes, STATE_PATH, REFRESH_PATH } from './routes.js'
 // dsh-cost-meter — host half.
 //
 // The harness prices nothing on purpose: pi-ai carries a `cost` field but
@@ -14,7 +14,6 @@ import { registerPluginUpdater } from './updater.js'
 //
 // No agent hooks: the widget only reads, so it cannot corrupt a session.
 
-import { createHash } from 'node:crypto'
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { dirname, join } from 'node:path'
@@ -22,35 +21,49 @@ import z from '@deepseek-ai/schemastery'
 
 // Ensure .volatile() helper exists on Schemastery schema prototype for DSH 0.2
 try {
-  const schemaProto = Object.getPrototypeOf(z.boolean())
-  if (schemaProto && typeof schemaProto.volatile !== 'function') {
-    schemaProto.volatile = function () {
-      return typeof this.extra === 'function' ? this.extra('volatile', true) : this
-    }
+  const p = Object.getPrototypeOf(z.boolean())
+  if (p && typeof p.volatile !== 'function') {
+    p.volatile = function () { return typeof this.extra === 'function' ? this.extra('volatile', true) : this }
   }
-} catch {
-  // safe fallback
-}
-import { z as zod } from 'zod'
+} catch {}
 
 export * from './tariff.js'
-import { indexCatalog, resolveTariff, matchModel } from './tariff.js'
+export * from './projection.js'
+export { STATE_PATH, REFRESH_PATH } from './routes.js'
+import { indexCatalog, resolveTariff, matchModel, unwrapVolatile } from './tariff.js'
+import { usageByModelProjection } from './projection.js'
 
 export const name = '@goodandready/dsh-cost-meter'
 export const inject = ['webServer', 'settings', 'sessionProjections']
 
 const NS = 'dsh-cost-meter'
-const STATE_PATH = '/dsh-cost-meter/state'
-const REFRESH_PATH = '/dsh-cost-meter/refresh'
 export function isLoopback(value) {
   const address = value?.toLowerCase().replace(/^\[|\]$/g, '')
   return address === 'localhost' || address === 'localhost.' || address === '::1'
-    || address?.startsWith('127.') === true
-    || address?.startsWith('::ffff:127.') === true
+    || address?.startsWith('127.') === true || address?.startsWith('::ffff:127.') === true
+}
+
+export function getConnection(ctx) {
+  try {
+    const f = ctx?.reflect?.get
+      ? (ctx.reflect.get('connection') || ctx?.connection)
+      : (ctx?.get ? (ctx.get('connection') || ctx?.connection) : Reflect.get(ctx || {}, 'connection'))
+    return f || (ctx?.root ? getConnection(ctx.root) : undefined)
+  } catch {
+    return undefined
+  }
 }
 
-export function isTrustedCaller(request) {
+export function isTrustedCaller(request, ctx = null) {
   if (!request) return false
+  const conn = getConnection(ctx) || request?.connectionService || request?.connection
+  if (conn && typeof conn.requestRejection === 'function') {
+    try {
+      if (conn.requestRejection(request) !== undefined) return false
+    } catch {
+      return false
+    }
+  }
   const remote = request.socket?.remoteAddress || request.connection?.remoteAddress
   const site = request.headers?.['sec-fetch-site']
   if (site === 'cross-site') return false
@@ -97,6 +110,24 @@ export function isTrustedCaller(request) {
   return false
 }
 
+export function normalizeConfig(raw) {
+  const u = unwrapVolatile(raw) || {}
+  return {
+    ...u,
+    currency: typeof u.currency === 'string' && u.currency ? u.currency : '$',
+    usdRate: Number(u.usdRate) > 0 ? Number(u.usdRate) : 1,
+    displayTimeZone: typeof u.displayTimeZone === 'string' && u.displayTimeZone ? u.displayTimeZone : 'Europe/Moscow',
+    budgetThreshold: Number(u.budgetThreshold) || 0,
+    useOpenRouter: u.useOpenRouter !== false,
+    refreshHours: Number(u.refreshHours) || 24,
+    deepseekPeakPrices: u.deepseekPeakPrices || {},
+    modelMap: u.modelMap || {},
+    prices: u.prices || {},
+    manualPeakWindowsUtc: Array.isArray(u.manualPeakWindowsUtc) ? u.manualPeakWindowsUtc : [],
+    manualOffPeakMultiplier: Number(u.manualOffPeakMultiplier) || 1,
+  }
+}
+
 const CATALOG_URL = 'https://openrouter.ai/api/v1/models'
 const CACHE_FILE = join(process.env.DSH_HOME || join(homedir(), '.dsh'), 'storages', 'dsh-cost-meter-catalog.json')
 
@@ -111,189 +142,18 @@ const PriceRow = z.object({
 export const Config = z.object({
   currency: z.string().description('Currency symbol shown in the widget.').default('$').volatile(),
   usdRate: z.number().description('Units of `currency` per USD. 1 keeps everything in USD.').default(1).volatile(),
-  displayTimeZone: z
-    .string()
-    .description('IANA zone the widget shows tariff hours in.')
-    .default('Europe/Moscow')
-    .volatile(),
-  budgetThreshold: z
-    .number()
-    .description('Optional session budget threshold in USD. 0 disables threshold warnings.')
-    .default(0)
-    .volatile(),
-  deepseekPeakPrices: z
-    .dict(PriceRow)
-    .description('Override the built-in DeepSeek peak rates, by model id.')
-    .default({})
-    .volatile(),
-  useOpenRouter: z
-    .boolean()
-    .description('Pull rates and discount windows from the public OpenRouter catalog.')
-    .default(true)
-    .volatile(),
+  displayTimeZone: z.string().description('IANA zone the widget shows tariff hours in.').default('Europe/Moscow').volatile(),
+  budgetThreshold: z.number().description('Optional session budget threshold in USD. 0 disables threshold warnings.').default(0).volatile(),
+  deepseekPeakPrices: z.dict(PriceRow).description('Override the built-in DeepSeek peak rates, by model id.').default({}).volatile(),
+  useOpenRouter: z.boolean().description('Pull rates and discount windows from the public OpenRouter catalog.').default(true).volatile(),
   refreshHours: z.number().description('How often to refetch the catalog.').default(24).volatile(),
-  modelMap: z
-    .dict(z.string())
-    .description('Route override: "provider/model" -> OpenRouter model id.')
-    .default({})
-    .volatile(),
-  prices: z
-    .dict(PriceRow)
-    .description('Manual rates by "provider/model" (or "*"). Win over the catalog.')
-    .default({})
-    .volatile(),
-  manualPeakWindowsUtc: z
-    .array(z.string())
-    .description('Peak windows HH:MM-HH:MM UTC, used only with manual prices.')
-    .default([])
-    .volatile(),
-  manualOffPeakMultiplier: z
-    .number()
-    .description('Multiplier outside the manual peak windows.')
-    .default(1)
-    .volatile(),
+  modelMap: z.dict(z.string()).description('Route override: "provider/model" -> OpenRouter model id.').default({}).volatile(),
+  prices: z.dict(PriceRow).description('Manual rates by "provider/model" (or "*"). Win over the catalog.').default({}).volatile(),
+  manualPeakWindowsUtc: z.array(z.string()).description('Peak windows HH:MM-HH:MM UTC, used only with manual prices.').default([]).volatile(),
+  manualOffPeakMultiplier: z.number().description('Multiplier outside the manual peak windows.').default(1).volatile(),
 })
 
-// ---------------------------------------------------------------------------
-// Per-model usage projection
-// ---------------------------------------------------------------------------
-
-const ZERO = { uncachedInputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheWriteTokens: 0 }
-
-const bucketSchema = zod.object({
-  uncachedInputTokens: zod.number().nonnegative(),
-  outputTokens: zod.number().nonnegative(),
-  cacheReadTokens: zod.number().nonnegative(),
-  cacheWriteTokens: zod.number().nonnegative(),
-}).strict()
-
-/** Pull the four buckets out of one provider usage record. */
-function bucketsFromUsage(usage) {
-  return {
-    uncachedInputTokens: Number(usage.inputTokens) || 0,
-    outputTokens: Number(usage.outputTokens) || 0,
-    cacheReadTokens: Number(usage.cacheReadTokens) || 0,
-    cacheWriteTokens: Number(usage.cacheWriteTokens) || 0,
-  }
-}
-
-function addBuckets(base, remove, add) {
-  const out = {}
-  for (const k of Object.keys(ZERO)) {
-    out[k] = (base[k] || 0) - ((remove && remove[k]) || 0) + (add[k] || 0)
-  }
-  return out
-}
-
-function sameBuckets(a, b) {
-  return a && b && Object.keys(ZERO).every((k) => (a[k] || 0) === (b[k] || 0))
-}
-
-/** The usage a streamed chunk or a finalized assistant message reports. */
-function usageOf(event) {
-  if (event.type === 'assistant/chunk' && event.data.chunk && event.data.chunk.type === 'usage') {
-    return { turn: event.data.turn, step: event.data.step, usage: event.data.chunk.usage }
-  }
-  if (event.type === 'assistant/message' && event.data.usage !== undefined) {
-    return { turn: event.data.turn, step: event.data.step, usage: event.data.usage }
-  }
-  return undefined
-}
-
-/**
- * Half-hour slot of the UTC day an event falls into (0..47).
- */
-export function slotOf(timeMs) {
-  let ms = typeof timeMs === 'number' && Number.isFinite(timeMs) ? timeMs : NaN
-  if (Number.isNaN(ms)) {
-    if (timeMs instanceof Date && !Number.isNaN(timeMs.getTime())) {
-      ms = timeMs.getTime()
-    } else {
-      ms = Date.now()
-    }
-  }
-  const d = new Date(ms)
-  return Math.floor((d.getUTCHours() * 60 + d.getUTCMinutes()) / 30)
-}
-
-const modelSlotsSchema = zod.record(zod.string(), bucketSchema)
-
-const costByModelViewSchema = zod.object({
-  models: zod.array(zod.object({
-    provider: zod.string(),
-    model: zod.string(),
-    slots: modelSlotsSchema,
-  }).strict()),
-}).strict()
-
-const costByModelStateSchema = zod.object({
-  route: zod.object({
-    provider: zod.string(),
-    model: zod.string(),
-  }).nullable(),
-  byKey: zod.record(zod.string(), modelSlotsSchema),
-  last: zod.object({
-    turn: zod.number().int().nonnegative(),
-    step: zod.number().int().nonnegative(),
-    key: zod.string(),
-    slot: zod.string(),
-    buckets: bucketSchema,
-  }).nullable(),
-}).strict()
-
-export const usageByModelProjection = {
-  key: 'costByModel',
-  stateVersion: 2,
-  stateSchema: costByModelStateSchema,
-  init: () => ({ route: null, byKey: {}, last: null }),
-  apply: (state, event) => {
-    if (event.type === 'request/header') {
-      const config = event.data && event.data.header && event.data.header.config
-      const provider = config && typeof config.provider === 'string' ? config.provider : undefined
-      const model = config && typeof config.model === 'string' ? config.model : undefined
-      if (provider === undefined || model === undefined) return state
-      if (state.route && state.route.provider === provider && state.route.model === model) return state
-      return { ...state, route: { provider, model } }
-    }
-    const sample = usageOf(event)
-    if (sample === undefined) return state
-    const route = state.route || { provider: '', model: 'unknown' }
-    const key = route.provider + '/' + route.model
-    const slot = String(slotOf(event.time))
-    const buckets = bucketsFromUsage(sample.usage)
-    const previous =
-      state.last !== null &&
-      state.last.turn === sample.turn &&
-      state.last.step === sample.step &&
-      state.last.key === key &&
-      state.last.slot === slot
-        ? state.last.buckets
-        : undefined
-    if (previous !== undefined && sameBuckets(previous, buckets)) return state
-    const slots = state.byKey[key] || {}
-    return {
-      route: state.route,
-      byKey: {
-        ...state.byKey,
-        [key]: { ...slots, [slot]: addBuckets(slots[slot] || ZERO, previous, buckets) },
-      },
-      last: { turn: sample.turn, step: sample.step, key, slot, buckets },
-    }
-  },
-  wire: {
-    viewSchema: costByModelViewSchema,
-    view: (state) => ({
-      models: Object.keys(state.byKey).map((key) => {
-        const slash = key.indexOf('/')
-        return {
-          provider: key.slice(0, slash),
-          model: key.slice(slash + 1),
-          slots: state.byKey[key],
-        }
-      }),
-    }),
-  },
-}
+// Per-model usage projection is defined in and exported from ./projection.js
 
 /** The agent's default route, read off settings descriptors when available. */
 function defaultRoute(ctx) {
@@ -321,9 +181,8 @@ export function splitRoute(key) {
 }
 
 export function apply(ctx, config) {
-  let current = config
+  let current = normalizeConfig(config)
   let catalog = { index: { byId: {}, byLowerId: {}, bySuffix: {} }, fetchedAt: 0, error: null }
-  let lastManualRefreshAt = 0
 
   // Server-side cache for resolved tariffs: key -> { schedule, source, matchedId }
   const resolveCache = new Map()
@@ -396,14 +255,14 @@ export function apply(ctx, config) {
     }
     const row = readRow()
     if (row?.value && typeof row.value === 'object') {
-      current = { ...config, ...row.value }
+      current = normalizeConfig({ ...config, ...row.value })
       clearResolveCache()
     }
     ctx.on('settings/document-updated', (ns) => {
       if (ns && ns !== NS) return
       const fresh = readRow()
       if (fresh?.value && typeof fresh.value === 'object') {
-        current = { ...config, ...fresh.value }
+        current = normalizeConfig({ ...config, ...fresh.value })
       }
       clearResolveCache()
     })
@@ -415,122 +274,16 @@ export function apply(ctx, config) {
     eff(() => pctx.sessionProjections.register(usageByModelProjection))
   })
 
-  // Route 1: POST /dsh-cost-meter/refresh (manual catalog reload)
-  ctx.effect(
-    () =>
-      ctx.webServer.register({
-        path: REFRESH_PATH,
-        method: 'POST',
-        handler: async (req, res) => {
-          if (!isTrustedCaller(req)) {
-            res.writeHead(403, { 'Content-Type': 'application/json' })
-            res.end(JSON.stringify({ error: 'forbidden' }))
-            return
-          }
-          const now = Date.now()
-          if (now - lastManualRefreshAt < 60_000) {
-            res.writeHead(429, { 'Content-Type': 'application/json' })
-            res.end(JSON.stringify({ error: 'rate_limited', retryAfterMs: 60_000 - (now - lastManualRefreshAt) }))
-            return
-          }
-          lastManualRefreshAt = now
-          await refresh(null, true)
-          res.writeHead(200, { 'Content-Type': 'application/json' })
-          res.end(
-            JSON.stringify({
-              ok: !catalog.error,
-              fetchedAt: catalog.fetchedAt,
-              models: Object.keys((catalog.index && catalog.index.byId) || {}).length,
-              error: catalog.error,
-            }),
-          )
-        },
-      }),
-    'dsh-cost-meter: refresh route',
-  )
-
-  // Route 2: GET /dsh-cost-meter/state (the browser poller hits this)
-  ctx.effect(
-    () =>
-      ctx.webServer.register({
-        path: STATE_PATH,
-        method: 'GET',
-        handler: async (req, res) => {
-          if (!isTrustedCaller(req)) {
-            res.writeHead(403, { 'Content-Type': 'application/json' })
-            res.end(JSON.stringify({ error: 'forbidden' }))
-            return
-          }
-          const cfg = current ?? config
-
-          // On the very first request after boot, wait for the fetch if we have
-          // no disk cache either. Later runs refresh in the background.
-          if (!catalog.fetchedAt && !catalog.error) {
-            await refresh()
-          } else {
-            void refresh()
-          }
-
-          const route = defaultRoute(ctx) ?? null
-          const own = getCachedTariff(cfg, route)
-
-          // Also resolve tariffs for any session routes requested in query params
-          const schedules = {}
-          const url = new URL(req.url, 'http://localhost')
-          const extraRoutes = url.searchParams.getAll('route')
-          for (const key of extraRoutes) {
-            const parsed = splitRoute(key)
-            if (parsed) {
-              const res = getCachedTariff(cfg, parsed)
-              if (res && res.schedule) schedules[key] = res.schedule
-            }
-          }
-
-          const payloadObj = {
-            currency: cfg.currency,
-            usdRate: cfg.usdRate,
-            displayTimeZone: cfg.displayTimeZone || 'Europe/Moscow',
-            budgetThreshold: Number(cfg.budgetThreshold) || 0,
-            route,
-            source: own.source,
-            matchedId: own.matchedId,
-            schedules,
-            fetchedAt: catalog.fetchedAt || null,
-            catalogError: catalog.error,
-            catalogModelsCount: Object.keys((catalog.index && catalog.index.byId) || {}).length,
-            schedule: own.schedule,
-          }
-
-          const serialized = JSON.stringify(payloadObj)
-          const etag = 'W/"' + createHash('sha1').update(serialized).digest('base64url').slice(0, 16) + '"'
-
-          if (req.headers['if-none-match'] === etag) {
-            res.writeHead(304, {
-              'ETag': etag,
-              'Cache-Control': 'no-cache',
-            })
-            res.end()
-            return
-          }
-
-          res.writeHead(200, {
-            'Content-Type': 'application/json',
-            'Cache-Control': 'no-cache',
-            'ETag': etag,
-          })
-          res.end(serialized)
-        },
-      }),
-    'dsh-cost-meter: state route',
-  )
-
-  // Route 3: /dsh-cost-meter/update (in-app one-click updater)
-  if (ctx.webServer?.register) {
-    ctx.effect(() => registerPluginUpdater(ctx, {
-      endpoint: '/dsh-cost-meter/update',
-      packageName: name,
-      manifestUrl: new URL('../package.json', import.meta.url),
-    }), 'dsh-cost-meter: updater')
-  }
-
+  // Register HTTP routes (refresh, state, update) via webServer service
+  registerRoutes(ctx, {
+    name,
+    isTrustedCaller,
+    getCachedTariff,
+    refresh,
+    splitRoute,
+    defaultRoute,
+    getCurrentConfig: () => (current ? normalizeConfig(current) : normalizeConfig(config)),
+    getCatalog: () => catalog,
+  })
 }
+

package/lib/projection.js

@@ -0,0 +1,139 @@
+// dsh-cost-meter — per-model usage projection for sessionProjections service.
+import { z as zod } from 'zod'
+
+export const ZERO = { uncachedInputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheWriteTokens: 0 }
+
+export const bucketSchema = zod.object({
+  uncachedInputTokens: zod.number().nonnegative(),
+  outputTokens: zod.number().nonnegative(),
+  cacheReadTokens: zod.number().nonnegative(),
+  cacheWriteTokens: zod.number().nonnegative(),
+}).strict()
+
+/** Pull the four buckets out of one provider usage record. */
+export function bucketsFromUsage(usage) {
+  return {
+    uncachedInputTokens: Number(usage.inputTokens) || 0,
+    outputTokens: Number(usage.outputTokens) || 0,
+    cacheReadTokens: Number(usage.cacheReadTokens) || 0,
+    cacheWriteTokens: Number(usage.cacheWriteTokens) || 0,
+  }
+}
+
+export function addBuckets(base, remove, add) {
+  const out = {}
+  for (const k of Object.keys(ZERO)) {
+    out[k] = (base[k] || 0) - ((remove && remove[k]) || 0) + (add[k] || 0)
+  }
+  return out
+}
+
+export function sameBuckets(a, b) {
+  return a && b && Object.keys(ZERO).every((k) => (a[k] || 0) === (b[k] || 0))
+}
+
+/** The usage a streamed chunk or a finalized assistant message reports. */
+export function usageOf(event) {
+  if (event.type === 'assistant/chunk' && event.data.chunk && event.data.chunk.type === 'usage') {
+    return { turn: event.data.turn, step: event.data.step, usage: event.data.chunk.usage }
+  }
+  if (event.type === 'assistant/message' && event.data.usage !== undefined) {
+    return { turn: event.data.turn, step: event.data.step, usage: event.data.usage }
+  }
+  return undefined
+}
+
+/**
+ * Half-hour slot of the UTC day an event falls into (0..47).
+ */
+export function slotOf(timeMs) {
+  let ms = typeof timeMs === 'number' && Number.isFinite(timeMs) ? timeMs : NaN
+  if (Number.isNaN(ms)) {
+    if (timeMs instanceof Date && !Number.isNaN(timeMs.getTime())) {
+      ms = timeMs.getTime()
+    } else {
+      ms = Date.now()
+    }
+  }
+  const d = new Date(ms)
+  return Math.floor((d.getUTCHours() * 60 + d.getUTCMinutes()) / 30)
+}
+
+export const modelSlotsSchema = zod.record(zod.string(), bucketSchema)
+
+export const costByModelViewSchema = zod.object({
+  models: zod.array(zod.object({
+    provider: zod.string(),
+    model: zod.string(),
+    slots: modelSlotsSchema,
+  }).strict()),
+}).strict()
+
+export const costByModelStateSchema = zod.object({
+  route: zod.object({
+    provider: zod.string(),
+    model: zod.string(),
+  }).nullable(),
+  byKey: zod.record(zod.string(), modelSlotsSchema),
+  last: zod.object({
+    turn: zod.number().int().nonnegative(),
+    step: zod.number().int().nonnegative(),
+    key: zod.string(),
+    slot: zod.string(),
+    buckets: bucketSchema,
+  }).nullable(),
+}).strict()
+
+export const usageByModelProjection = {
+  key: 'costByModel',
+  stateVersion: 2,
+  stateSchema: costByModelStateSchema,
+  init: () => ({ route: null, byKey: {}, last: null }),
+  apply: (state, event) => {
+    if (event.type === 'request/header') {
+      const config = event.data && event.data.header && event.data.header.config
+      const provider = config && typeof config.provider === 'string' ? config.provider : undefined
+      const model = config && typeof config.model === 'string' ? config.model : undefined
+      if (provider === undefined || model === undefined) return state
+      if (state.route && state.route.provider === provider && state.route.model === model) return state
+      return { ...state, route: { provider, model } }
+    }
+    const sample = usageOf(event)
+    if (sample === undefined) return state
+    const route = state.route || { provider: '', model: 'unknown' }
+    const key = route.provider + '/' + route.model
+    const slot = String(slotOf(event.time))
+    const buckets = bucketsFromUsage(sample.usage)
+    const previous =
+      state.last !== null &&
+      state.last.turn === sample.turn &&
+      state.last.step === sample.step &&
+      state.last.key === key &&
+      state.last.slot === slot
+        ? state.last.buckets
+        : undefined
+    if (previous !== undefined && sameBuckets(previous, buckets)) return state
+    const slots = state.byKey[key] || {}
+    return {
+      route: state.route,
+      byKey: {
+        ...state.byKey,
+        [key]: { ...slots, [slot]: addBuckets(slots[slot] || ZERO, previous, buckets) },
+      },
+      last: { turn: sample.turn, step: sample.step, key, slot, buckets },
+    }
+  },
+  wire: {
+    viewSchema: costByModelViewSchema,
+    view: (state) => ({
+      models: Object.keys(state.byKey).map((key) => {
+        const slash = key.indexOf('/')
+        return {
+          provider: key.slice(0, slash),
+          model: key.slice(slash + 1),
+          slots: state.byKey[key],
+        }
+      }),
+    }),
+  },
+}

package/lib/routes.js

@@ -0,0 +1,143 @@
+// dsh-cost-meter — HTTP routes registration for webServer service.
+import { createHash } from 'node:crypto'
+import { registerPluginUpdater } from './updater.js'
+
+export const STATE_PATH = '/dsh-cost-meter/state'
+export const REFRESH_PATH = '/dsh-cost-meter/refresh'
+
+export function registerRoutes(ctx, options) {
+  const {
+    name,
+    isTrustedCaller,
+    getCachedTariff,
+    refresh,
+    splitRoute,
+    defaultRoute,
+    getCurrentConfig,
+    getCatalog,
+  } = options
+
+  let lastManualRefreshAt = 0
+
+  // Route 1: POST /dsh-cost-meter/refresh (manual catalog reload)
+  ctx.effect(
+    () =>
+      ctx.webServer.register({
+        path: REFRESH_PATH,
+        method: 'POST',
+        handler: async (req, res) => {
+          if (!isTrustedCaller(req, ctx)) {
+            res.writeHead(403, { 'Content-Type': 'application/json' })
+            res.end(JSON.stringify({ error: 'forbidden' }))
+            return
+          }
+          const now = Date.now()
+          if (now - lastManualRefreshAt < 60_000) {
+            res.writeHead(429, { 'Content-Type': 'application/json' })
+            res.end(JSON.stringify({ error: 'rate_limited', retryAfterMs: 60_000 - (now - lastManualRefreshAt) }))
+            return
+          }
+          lastManualRefreshAt = now
+          await refresh(null, true)
+          const catalog = getCatalog()
+          res.writeHead(200, { 'Content-Type': 'application/json' })
+          res.end(
+            JSON.stringify({
+              ok: !catalog.error,
+              fetchedAt: catalog.fetchedAt,
+              models: Object.keys((catalog.index && catalog.index.byId) || {}).length,
+              error: catalog.error,
+            }),
+          )
+        },
+      }),
+    'dsh-cost-meter: refresh route',
+  )
+
+  // Route 2: GET /dsh-cost-meter/state (the browser poller hits this)
+  ctx.effect(
+    () =>
+      ctx.webServer.register({
+        path: STATE_PATH,
+        method: 'GET',
+        handler: async (req, res) => {
+          if (!isTrustedCaller(req, ctx)) {
+            res.writeHead(403, { 'Content-Type': 'application/json' })
+            res.end(JSON.stringify({ error: 'forbidden' }))
+            return
+          }
+          const cfg = getCurrentConfig()
+          let catalog = getCatalog()
+
+          // On the very first request after boot, wait for the fetch if we have
+          // no disk cache either. Later runs refresh in the background.
+          if (!catalog.fetchedAt && !catalog.error) {
+            await refresh()
+            catalog = getCatalog()
+          } else {
+            void refresh()
+          }
+
+          const route = defaultRoute(ctx) ?? null
+          const own = getCachedTariff(cfg, route)
+
+          // Also resolve tariffs for any session routes requested in query params
+          const schedules = {}
+          const url = new URL(req.url, 'http://localhost')
+          const extraRoutes = url.searchParams.getAll('route')
+          for (const key of extraRoutes) {
+            const parsed = splitRoute(key)
+            if (parsed) {
+              const res = getCachedTariff(cfg, parsed)
+              if (res && res.schedule) schedules[key] = res.schedule
+            }
+          }
+
+          const payloadObj = {
+            currency: typeof cfg?.currency === 'string' && cfg.currency ? cfg.currency : '$',
+            usdRate: Number(cfg?.usdRate) > 0 ? Number(cfg.usdRate) : 1,
+            displayTimeZone: typeof cfg?.displayTimeZone === 'string' && cfg.displayTimeZone ? cfg.displayTimeZone : 'Europe/Moscow',
+            budgetThreshold: Number(cfg?.budgetThreshold) || 0,
+            route,
+            source: own.source,
+            matchedId: own.matchedId,
+            schedules,
+            fetchedAt: catalog.fetchedAt || null,
+            catalogError: catalog.error,
+            catalogModelsCount: Object.keys((catalog.index && catalog.index.byId) || {}).length,
+            schedule: own.schedule,
+          }
+
+          const serialized = JSON.stringify(payloadObj)
+          const etag = 'W/"' + createHash('sha1').update(serialized).digest('base64url').slice(0, 16) + '"'
+
+          if (req.headers['if-none-match'] === etag) {
+            res.writeHead(304, {
+              'ETag': etag,
+              'Cache-Control': 'no-cache',
+            })
+            res.end()
+            return
+          }
+
+          res.writeHead(200, {
+            'Content-Type': 'application/json',
+            'Cache-Control': 'no-cache',
+            'ETag': etag,
+          })
+          res.end(serialized)
+        },
+      }),
+    'dsh-cost-meter: state route',
+  )
+
+  // Route 3: /dsh-cost-meter/update (in-app one-click updater)
+  if (ctx.webServer?.register) {
+    ctx.effect(() => registerPluginUpdater(ctx, {
+      endpoint: '/dsh-cost-meter/update',
+      packageName: name,
+      manifestUrl: new URL('../package.json', import.meta.url),
+    }), 'dsh-cost-meter: updater')
+  }
+}
+

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-cost-meter",
-  "version": "0.8.15",
+  "version": "0.8.17",
   "description": "DeepSeek Harness plugin: a session cost chip in the conversation header - live token usage by bucket, peak/off-peak tariff, and a countdown to the next tariff switch.",
   "type": "module",
   "main": "lib/index.js",